CVE-2026-33045: Home Assistant has stored XSS in history-graphs

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-79

Description

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the "remaining charge time"-sensor for mobile phones (imported/included from Android Auto it appears) is vulnerable cross-site scripting, similar to CVE-2025-62172. Version 2026.01 fixes the issue.

Affected products

Home-Assistant: from 2025.2.0 before 2026.1.0 — fixed in 2026.1.0

How to fix

Upgrade to a fixed version: Home-Assistant 2026.1.0. Check the vendor advisory for mitigations.

References

https://github.com/home-assistant/core/security/advisories/GHSA-46j8-vpx8-6p72
https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m
https://github.com/home-assistant/core/security/advisories/GHSA-46j8-vpx8-6p72

Get alerted when CVE-2026-33045 or the next vulnerability affects your stack